DragonForce ransomware employed a Go-based remote access trojan called Backdoor.Turn that abuses Microsoft Teams' TURN relay servers to conceal C2 communications. By obtaining anonymous Teams visitor tokens and routing traffic through legitimate TURN relays, the malware hides its network activity within trusted Microsoft infrastructure. The attack chain began with exploitation of an unknown SQL/MSSQL vulnerability, followed by deployment of malicious DLL sideloaded via legitimate executables, persistence mechanisms, and kernel-level privilege escalation using multiple vulnerable drivers (including Huawei’s HWAuidoOs2Ec.sys and others with known CVEs). The malware's capabilities include command execution, process creation, network reconnaissance, TLS certificate capture, LDAP/Active Directory enumeration, website title collection, and browser credential theft. After reconnaissance and evasion, data exfiltration and ransomware deployment occurred. This is the first known in-the-wild malware abusing Microsoft Teams TURN relays for C2 communications, illustrating advanced evasion and stealth techniques.

The threat enables attackers to hide command-and-control traffic within legitimate Microsoft Teams relay infrastructure, complicating detection by security tools. The attackers achieved kernel-level privileges to disable security products and maintain persistence. The malware facilitates extensive reconnaissance, credential theft, and network scanning, leading to data exfiltration and deployment of DragonForce ransomware, resulting in system encryption and operational disruption. The use of legitimate infrastructure for C2 communications increases the difficulty of identifying malicious activity, potentially prolonging attacker dwell time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Defenders should monitor for indicators of compromise published by Symantec related to Backdoor.Turn and DragonForce activity. Network defenders should be aware of potential abuse of Microsoft Teams TURN relay infrastructure for C2 traffic. Employ detection rules targeting anomalous use of Teams TURN tokens and relay connections. Investigate and remediate vulnerable drivers exploited for privilege escalation. Since this technique abuses legitimate Microsoft infrastructure, enhanced monitoring of Teams traffic and endpoint behavior is recommended. No official patch or fix is indicated in the provided information.